Public observations, not system access
The free scan uses Google Public DNS and Qualys SSL Labs for external observations. It does not require an agent, repository connection, private key or cloud credentials. Targets are validated, provider addresses are fixed, and HTTPS assessments are withheld when resolved addresses are not publicly routable.
Private request storage
Scan requests, demo enquiries and partner applications are stored in Lovable Cloud. Website visitors cannot publicly read those submission tables. The service returns normalized domain findings, not the associated email or company details.
These controls describe application-level access boundaries, not an independent audit of every hosting or operational process.
Time-limited results and abuse controls
A scan-session capability grants access to findings for approximately 30 minutes. Treat access links or tokens as confidential; anyone holding a valid capability may access its results until expiry. Expiry is not automatic data deletion.
Scan reservations and polling limits are enforced centrally to reduce repeat-request abuse and excessive provider traffic. Provider outages and incomplete evidence are shown explicitly rather than replaced with fabricated findings.
Encryption and evidence
The site is intended to be accessed over HTTPS. A report describes encryption observed on the submitted domain; it does not change that domain's cryptography or certify the security of PlancKey's own infrastructure. Hosting-provider protections are not a claim that this product is post-quantum secure.
Certifications and future integrations
No independently verified SOC 2 report or ISO 27001 certification is presented for PlancKey. References to NIST algorithms describe assessment criteria, not NIST approval or certification.
Internal discovery, continuous monitoring, trust profiles and enterprise integrations are proposed paid offerings. Specific permissions, data handling and availability must be reviewed and agreed before an integration is enabled. CI/CD guard remains on the roadmap.
Reporting a security concern
Use the contact form linked on this page, select “Other” and enter “Security report” in the company field. Begin with a brief, nonsensitive description. Do not submit credentials, exploit payloads or customer data through the form. A dedicated security contact and incident-response commitments must be established before commercial launch.
Do not access another person's information, disrupt the service or conduct intrusive testing without prior written permission. No bug-bounty payment or safe-harbor programme is offered by this page.
Further information
Read our privacy notice for current storage and provider disclosures and our terms of use for scan limitations. Request a discussion before relying on a paid service for regulated or sensitive workloads.
